USB-RAID-Array/Web/content/changepassword.php

<?php
require_once __DIR__ . '/../includes/auth.php';
requireLogin('../index.php');
require_once __DIR__ . '/../config/config.php';
require_once __DIR__ . '/../includes/workspace.php';

$message = '';
$messageType = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $messageType = 'danger';
    $currentPassword = $_POST['current_password'] ?? null;
    $newPassword = $_POST['new_password'] ?? null;
    $confirmPassword = $_POST['confirm_password'] ?? null;

    if (!is_string($currentPassword) || !is_string($newPassword) || !is_string($confirmPassword)) {
        $message = 'All fields are required!';
    } elseif (!isPasswordValid($newPassword)) {
        $message = 'New password must be at least 8 characters long, contain at least one number and one uppercase letter!';
    } elseif ($newPassword !== $confirmPassword) {
        $message = 'New passwords do not match!';
    } else {
        $database = getDatabaseConnection();
        try {
            $username = $_SESSION['uname'];
            $statement = $database->prepare('SELECT pswd FROM users WHERE uname = ?');
            $statement->bind_param('s', $username);
            $statement->execute();
            $result = $statement->get_result();
            $user = $result->fetch_assoc();
            $result->free();
            $statement->close();

            if (!$user) {
                $message = 'User not found!';
            } elseif (!password_verify($currentPassword, $user['pswd'])) {
                $message = 'Current password is incorrect!';
            } else {
                $passwordHash = password_hash($newPassword, PASSWORD_BCRYPT);
                $statement = $database->prepare('UPDATE users SET pswd = ? WHERE uname = ?');
                $statement->bind_param('ss', $passwordHash, $username);
                $statement->execute();
                $statement->close();
                $message = 'Password changed successfully!';
                $messageType = 'success';
            }
        } catch (mysqli_sql_exception $exception) {
            error_log($exception->getMessage());
            $message = 'Unable to change password. Please try again.';
        } finally {
            $database->close();
        }
    }
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Change Password</title>
    <link rel="icon" href="../img/favicon.ico" type="image/x-icon">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'css/modern.css') ?>">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'css/workspace.css') ?>">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'content/css/changepassword.css') ?>">
    <script src="<?= workspaceAsset('../', 'js/theme.js') ?>"></script>
    <script src="<?= workspaceAsset('../', 'js/ui.js') ?>" defer></script>
</head>
<?php renderWorkspaceStart([
    'root' => '../',
    'active' => 'account',
    'section' => 'Account settings',
    'eyebrow' => 'Your account',
    'title' => 'Account settings',
    'description' => 'Keep your workspace account secure and up to date.',
    'class' => 'account-page',
]); ?>


        <section class="account-layout">
            <article class="content-panel">
                <div class="panel-heading"><h2>Change password</h2><p>Choose a strong password to protect your files.</p></div>

                <?php if ($message): ?>
                <div class="alert alert-<?php echo $messageType; ?> mb-4">
                    <?php echo $message; ?>
                </div>
                <?php endif; ?>

                <form method="POST" action="" class="mb-4 change-password-form">
                    <div class="mb-3">
                        <label class="form-label" for="currentPassword">Current password</label>
                        <input type="password" id="currentPassword" autocomplete="current-password" name="current_password" class="form-control" required>
                    </div>
                    <div class="mb-3">
                        <label class="form-label" for="newPassword">New password</label>
                        <input type="password" id="newPassword" autocomplete="new-password" name="new_password" class="form-control" required>
                    </div>
                    <div class="mb-3">
                        <label class="form-label" for="confirmPassword">Confirm new password</label>
                        <input type="password" id="confirmPassword" autocomplete="new-password" name="confirm_password" class="form-control" required>
                    </div>
                    <button type="submit" class="btn btn-primary">Change Password</button>
                </form>
            </article>
<aside class="account-help"><span class="eyebrow">Password requirements</span><h3>A little extra protection</h3><p>Use at least 8 characters, one uppercase letter and one number.</p><p>You can return to your files at any time using the workspace navigation.</p></aside>
        </section>

        <?php renderWorkspaceEnd(); ?>
</body>
</html>